Consider setting minimumReleaseAge in config:best-practices for more datasources

[pquentin]

Tell us more.

As a result of #37952, Renovate now uses a 3-day dependency cooldown for npm packages: https://docs.renovatebot.com/presets-config/#configbest-practices. That's great!

Unfortunately, this is only for npm, but other datasources support release timestamps. While it seems universally useful, I am personally interested in Python and PyPI. This has been a recurring topic of discussion in my circles:

• https://blog.yossarian.net/2025/11/21/We-should-all-be-using-dependency-cooldowns
• https://blog.yossarian.net/2025/12/13/cooldowns-redux
• https://nesbitt.io/2026/03/04/package-managers-need-to-cool-down.html

Related discussions:

• Package agnostic security:minimumReleaseAge preset #40553 is about having more datasource-specific configurations. Not sure I like it as I find minimumReleaseAgenpm to be easy to confuse with minimumReleaseAge
• Feature idea: `maxVersionsBehindLatest` — position-based supply chain version barrier #42376 is about introducing a different delays, based on version numbers.

[jamietanna]

Sorry, I thought I'd replied to this! Short answer is "yes" we are in agreement we'd like to do this.

Before we do it, we would need to invest in the security: preset first for each datasource, do some testing to see what does/does not work, and then in the next major, we'd introduce it

I'll raise some Issues about this shortly